openssl/openssl

Failures to load fips provider result in cryptic error due to bundling of conditionals

Open

#24,179 opened on 2024年4月18日

GitHub で見る
 (4 comments) (0 reactions) (0 assignees)C (11,262 forks)batch import
help wantedtriaged: feature

Repository metrics

Stars
 (30,157 stars)
PR merge metrics
 (30d に merged PR はありません)

説明

One of the common issues I've run into dealing with the FIPS provider is that the error handling in selftest.c isn't incredibly helpful. In particular, this line bundles together 2 conditionals to ensure the second conditional doesn't result in a SIGSEGV from a NULL pointer dereference... https://github.com/openssl/openssl/blob/e1fd043ad7fa865a8ef9160c892b49a098d23c71/providers/fips/self_test.c#L338-L339

This results in this cryptic error though:

+ env 'OPENSSL_CONF=$PWD/ossl_cnf_43Rk3C' openssl list -provider fips
list: unable to load provider fips
Hint: use -provider-path option or OPENSSL_MODULES environment variable.
00206134EF5C0000:error:1C8000D5:Provider routines:SELF_TEST_post:missing config data:/usr/src/crypto/openssl/providers/fips/self_test.c:275:
00206134EF5C0000:error:1C8000E0:Provider routines:ossl_set_error_state:fips module entering error state:/usr/src/crypto/openssl/providers/fips/self_test.c:373:
00206134EF5C0000:error:1C8000D8:Provider routines:OSSL_provider_init_int:self test post failure:/usr/src/crypto/openssl/providers/fips/fipsprov.c:707:
00206134EF5C0000:error:078C0105:common libcrypto routines:provider_init:init fail:/usr/src/crypto/openssl/crypto/provider_core.c:932:name=fips

Separating out the two conditionals would (at the very least) allow end-users to better determine what condition is causing the fips provider to not load. (in my particular scenario, it's the second case that's failing)

Contents of $OPENSSL_CONF

config_diagnostics = 1

# NB: the full path was omitted on purpose.
.include ${ENV::PWD}/ossl_cnf_43Rk3C.fips

openssl_conf = openssl_init

# Need to specify the absolute path here.

[openssl_init]
providers = provider_sect

# Load base + fips (default doesn't jive with fips).
[provider_sect]
base = base_sect
fips = fips_sect

[base_sect]
activate = 1

"fipsmodule.cnf" (ossl_cnf_43Rk3C.fips)

[fips_sect]
activate = 1
install-version = 1
conditional-errors = 1
security-checks = 1
module-mac = 61:78:FA:4A:37:53:45:AE:3E:59:D6:6B:4A:AD:B1:6E:66:1F:98:AF:7B:F8:CC:04:35:44:B7:69:84:6D:F9:B9
install-mac = 41:9C:38:C2:8F:59:09:43:2C:AA:2F:58:36:2D:D9:04:F9:6C:56:8B:09:E0:18:3A:2E:D6:CC:69:05:04:E1:11
install-status = INSTALL_SELF_TEST_KATS_RUN

コントリビューターガイド